Triple-A Says Customer Funds Safe After $9.7M Wallet Drain

Triple-A Wallet Drain Spans Multiple Networks

PeckShield’s July 25 alert said wallets linked to Triple-A appeared to have lost more than $9.7 million across Tron, Ethereum, Polygon and Arbitrum. Subsequent reports varied on the chain count, with Bitcoin.com News also identifying Solana and The Open Network in its account of the security firm’s findings.

That difference should not be treated as proof of six confirmed affected networks. It is an early indication that analysts were tracing several asset paths, while Triple-A has not yet released an address list, final loss total or technical post-mortem that would settle the scope.

The company’s product documentation says USDT payments can be accepted on five of the networks named in reporting. Payment providers commonly keep some liquidity accessible in online wallets so deposits, swaps and settlement can occur quickly, but the company has not said whether any of the reported wallets held customer assets, corporate liquidity or a mix of both.

Triple-A is not an unregulated long-tail service. Its website says its Singapore entity is licensed as a Major Payment Institution, while its European operation holds a French crypto-asset service-provider license. Those disclosures make the company’s customer-funds assurance a central fact, but they do not replace a forensic explanation of the reported movements.

5,227 ETH Reportedly Reaches One Ethereum Address

Onchain analyst Specter first flagged the activity, and PeckShield said the proceeds were bridged to Ethereum. The cited destination, 0x01F83B5d4fb30E8AA3daC1681B4048D9135253b1, was reported to hold about 5,227 ETH after the transfers.

Consolidation on one public address can make a reported asset trail easier to monitor, but it does not reveal the attacker, a technical exploit or the legal owner of every token. A wallet balance is also not a final loss figure: asset values, bridges, swaps, freezes and possible recovery attempts can change the accounting after the first alert.

The payments angle raises a different question from a typical DeFi smart-contract exploit. Merchants use such providers to move from a crypto payment to a fiat or stablecoin settlement workflow, so they need clarity on deposit status, cut-off times and whether any reconciliation is delayed.

Triple-A says customers can track transaction status through its dashboard and APIs. Until it names affected flows, however, users should rely on account notices and direct support rather than treating an address-monitoring thread as a settlement confirmation.

The event follows a period of intense security reporting. Daily Crypto Briefs recently covered CertiK’s $124.18 million count of physical-coercion exposure and TRM Labs’ record 207 reported hacks, both reminders that operational controls can be as important as code audits.

Triple-A Says Customer Funds Are Not Affected

The clearest company statement so far came through its spokesperson, Tatyana Chernov, who told BeInCrypto: “We are actively investigating the situation” and confirmed customer funds were not impacted. The statement is important, but it leaves open how the company separated customer claims from the reported wallet balances.

For readers with an active payment or payout, the practical checks are straightforward: verify individual transaction status in the Triple-A dashboard, preserve payment references, and follow any official notice before resubmitting a transfer. Repeating a payment while an original transaction is pending can create an avoidable reconciliation problem.

The incident also differs from the Raydium legacy AMM drain, where the protocol publicly identified dormant pools and said its treasury would compensate users. Triple-A has issued a customer-funds assurance but not an equivalent public inventory of affected wallets, a root cause or a timetable for a full report.

Crypto market sentiment remained subdued. Alternative.me’s Crypto Fear and Greed Index read 26, or Fear, on July 26, compared with 27 the previous day.

The next verifiable checkpoints are a direct Triple-A incident notice, any service-status update, a technical explanation of the wallet movements and continued monitoring of the reported Ethereum address. Until then, the reported $9.7 million trail and the company’s customer-funds assurance are the key confirmed public claims, not a completed forensic accounting.